Privacy Policy

Version 1.0-draft · DRAFT FOR LAWYER REVIEW · Effective: [EFFECTIVE DATE]

This explains what the badminton ladder collects, who can see it, and what you can do about it. We wrote it to match what the service actually does. If the service changes, this policy changes too.

Who we are: Badminton Ladder, [OPERATOR CONTACT EMAIL].

1. What we collect

Information	Why
Email address	To sign you in with a code and to send the notices you ask for
Display name	Shown to members of your group on the ladder and in match history
Your nickname in your WeChat group	So the group admin can check you really are in the WeChat group
Your WeChat ID (optional)	So a group admin can look you up in WeChat and check you are the person in their WeChat group
Match data: who played, the date, the score of each game, who recorded and who confirmed it, and when	To run the ladder and work out ratings
A coarse device label, such as "iPhone · WeChat"	To show you where you are signed in
Sign-in records: which document versions you accepted and when (no IP address)	To prove you accepted the terms
Feedback you choose to send: the type, your message, and, if you leave the switch on, the app version, your browser and phone type, language, text size and the page you came from. Your email only if you tick "You may email me about this"	To find and fix problems. Please do not put passwords or other people's personal details in a message
Challenges you send or receive: who invited whom, when, and the answer (accepted, or one of three fixed reasons for declining)	To let two members arrange a match. Only the two people involved can see a challenge
Reports you send: the reason and an optional short note	To let group admins (or, for a report about a group or its admins, the service owner) deal with a problem. The person you report is not told who reported
Notices: announcements written by group admins or by us	To tell members something short
Stored on your phone, not on our servers: an unsent match, and the tips and notices you closed (see the Cookie Notice)	So the app keeps working with a poor signal
Aggregate traffic counts (requests, errors, response times), not tied to you	To keep the service healthy

We do not collect passwords (there are none), photos, your location, or your contacts. Server logs are kept for 30 days and do not hold full IP addresses, emails, names or sign-in codes; rate limits use a shortened, hashed form of the source address that expires quickly. [TO CONFIRM: wording and the exact retention]

2. Who can see what

Members of your group see your display name, rating, rank and the confirmed matches you played, including each game's score. Matches that are only pending, rejected or voided are shown more narrowly.
Detailed analysis about you (performance, head-to-head list, activity) is visible only to you.
Rating chart and full history: if your group admin turns on "Members can see rating charts and full history of other members", other members of your group can also see your rating-over-time chart and your full list of confirmed matches. It is off by default.
Group admins also see the WeChat group nickname you gave when you asked to join and, if you gave one, your WeChat ID. Other members cannot see your WeChat ID, and neither can we (the operator). The person who records a match against you sees your nickname for that match, so they can mention you in the group.
We (the operator) see group-level summaries in our console, not members' names or matches. The exceptions are: feedback you send us (we read the message, and your email only if you allowed it; we are told by email that feedback arrived, but that email does not contain your message); reports about a group or its admins (we read the reason and note, never who reported); and the email of each group's owner, which we use for hosting notices. [TO CONFIRM: people with database or backup access can technically read stored data; describe access controls]
Nobody else. We do not sell your information and we do not share it for advertising. We use no third-party analytics or advertising scripts.

3. Email

Sign-in codes and match notices (for example, "a match needs your confirmation", "your match was confirmed", "your request was approved") are service emails. You can switch off the match notices in Settings, but sign-in codes are needed to sign in.
A weekly summary is optional, off by default, and has an unsubscribe link and a setting.
We do not send promotional email. [TO CONFIRM: if this ever changes, the sender, postal address and unsubscribe rules for commercial email must be added]
Email is sent through [TO CONFIRM: email service provider].

4. Who processes data for us

We use service providers to run the app: cloud hosting and database, an email delivery service, and monitoring. They process data only to provide those services. [TO CONFIRM: names, regions, data-processing agreements]

5. Where data is stored

In the United States. The service is intended for people in the United States only, so it is not designed for users elsewhere.

6. How long we keep it

Live data stays while your account and group exist.
Backups are made daily. They are encrypted and contain email addresses. Daily and weekly backups expire within weeks; the longest-kept monthly backups are kept for up to 12 months. Backups cannot be edited, so data you delete can remain in a backup until that backup expires.
A readable archive of match records keeps only internal IDs, scores, dates and the fixed void-reason category. It has no emails, names or free text.
Reports are removed 12 months after they are handled. [TO CONFIRM: retention]
Challenges are removed 12 months after they are closed (answered, cancelled, expired or played), and are closed when either account is deleted. [TO CONFIRM: retention]
When you delete your account, your name in each group becomes "Former member #n", your email is removed, your feedback is deleted, and your reports are disconnected from you. The matches stay, because they are also your opponents' history. If we ever restore from a backup, we delete your account again.
The closed-test environment keeps 14 days of backups and is wiped at the end of the test.
Feedback is deleted when you delete your account, and otherwise removed 12 months after we have dealt with it. [TO CONFIRM: retention]
A deleted group is hidden and can be restored for 30 days, and then removed. The group owner is reminded by email before that. [TO CONFIRM: logs]
Sign-in codes and sessions are short-lived and are not backed up. A session lasts up to 30 days.

7. Your choices and rights

See and correct your name, group nickname and WeChat ID in Settings.
Export your data in Settings. (This does not work inside WeChat's built-in browser; open the page in Safari or Chrome.)
Delete your account in Settings. We erase your email, group nickname, WeChat ID and sign-ins, and show you as "a former member". Your matches stay in your opponents' history without your name, because they are also the opponent's record.
Ask us by email at [OPERATOR CONTACT EMAIL]. We aim to answer within 30 days. [TO CONFIRM: response time and rights for users in other jurisdictions]

8. Security

We use encrypted connections, short-lived sign-in codes, hashed tokens, per-group access controls enforced in the database, and encrypted backups. No service is perfectly secure and we cannot promise it.

9. Children

You must be 13 or older. We do not knowingly collect information from children under 13. If you think a child has signed up, write to us and we will delete the account. [TO CONFIRM: COPPA and other child-privacy rules]

10. Changes

If this policy changes substantially we raise the version number, tell you in advance, and ask you to accept again.

11. If something goes wrong

If personal data is exposed we will tell affected people and the authorities where the law requires. [TO CONFIRM: notification duties and timing]

12. Contact

Badminton Ladder, [OPERATOR CONTACT EMAIL]